Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-28 | 2 | Patch1PoC1 |
| 2026-05-29 | 3 | Disclosure1Patch1PoC1 |
| 2026-05-30 | 2 | Disclosure1PoC1 |
| 2026-05-31 | 1 | Disclosure1 |
| 2026-06-02 | 2 | Patch2 |
| 2026-06-04 | 1 | Disclosure1 |
| 2026-06-05 | 1 | Active Exploitation1 |
| 2026-06-08 | 2 | Disclosure1Patch1 |
| 2026-06-11 | 1 | General1 |
| 2026-06-27 | 3 | Disclosure1General2 |
🚨 اذا انت من الجيل القديم ولاتزال تستخدم Notepad++ حدّث البرنامج فوراً إلى الإصدار الأخير (v8.9.6.1). 📍 الثغرة الأولى: (CVE-2026-48770) 📍 الثغرة الثانية: (CVE-2026-48778) 📍 الثغرة الثالثة: (CVE-2026-48800) https://t.co/Ke5sL7bgAl
Post summary
The tweet simply encourages users to update Notepad++ to avoid the listed CVEs, providing no detailed vulnerability or exploit information.
Notepad++ has released a security advisory addressing multiple critical vulnerabilities, including two arbitrary code execution flaws. The most severe flaw, CVE-2026-48778, allows attackers to silently run malicious code on a victim's machine via unvalidated config.xml files. Organizations using this popular text editor must upgrade to version v8.9.6.1 immediately to eliminate the exposure. Read the full technical breakdown and find your corresponding Qualys QID here: https://bit.ly/4dYYlWm #qualysthreatprotection #Notepad #CyberSecurity
Post summary
Notepad++ issues a patch advisory for CVE‑2026‑48778, a critical arbitrary code execution flaw that can be mitigated by upgrading to v8.9.6.1. Technical details are provided, but no PoC, exploit code, or evidence of active exploitation is reported.
GitHub - atiilla/Notepad-8.9.6-PoC: Proof-of-concept scripts for three vulnerabilities in Notepad++ <= 8.9.6, patched in v8.9.6.1 (2026-05-26) CVE-2026-48770 / CVE-2026-48778 / CVE-2026-48800 · GitHub - https://github.com/atiilla/Notepad-8.9.6-PoC
Post summary
The GitHub repo hosts proof‑of‑concept scripts for three Notepad++ CVEs (CVE‑2026‑48770, CVE‑2026‑48778, CVE‑2026‑48800), notes their patch in v8.9.6.1, but provides no active exploitation or detailed technical info.
Notepad++ patches a critical config.xml code execution flaw (CVE-2026-48778) alongside two other security bugs. Upgrade to version 8.9.6.1 immediately. #NotepadPlusPlus #CyberSecurity #CodeExecution #Vulnerability #Infosec #PatchTuesday #WindowsSecurity https://meterpreter.org/notepad-plus-plus-config-xml-code-execution-vulnerability/ https://t.co/p6PtWvbgvd
Post summary
Notepad++ releases a patch for CVE-2026-48778, a critical code execution flaw in config.xml, and urges users to upgrade to version 8.9.6.1 immediately.
Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) poc: https://github.com/intelseclab/poc-archive/tree/master/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve https://t.co/Et7ZKIEN5v
Post summary
The post announces multiple CVEs in Notepad++ and provides links to PoC code demonstrating exploitation, but no information on active attacks, patches, or technical details.
CVE-2026-48778 & CVE-2026-48800 | Notepad++ | CVSS 7.8 HIGH 🐛 Config file injection - fake Run menu entries execute attacker code and survive reboots ✅ Fixed: Notepad++ 8.9.6.1 (May 27) 🔗 https://notepad-plus-plus.org/news/v8961-released/ #CVE #Cybersecurity #InfoSec #PatchNow
Post summary
Notepad++’s config file injection flaw allows attackers to create persistent fake Run menu entries; the issue is fixed in version 8.9.6.1, as announced by the vendor.
A Notepad++ arbitrary code execution vulnerability (CVE-2026-48778) allows attackers to replace cmd.exe with malicious executables via config.xml. https://www.redsecuretech.co.uk/blog/post/notepad-arbitrary-code-execution-via-configxml-injection/1209 #NotepadPlusPlus #CVE #ArbitraryCodeExecution #ConfigXML #WindowsSecurity #AppData #InfoSec https://t.co/zoLuj0dOvs
Post summary
The tweet announces the discovery of CVE-2026-48778, describing its RCE nature and method of exploitation.
Se han revelado vulnerabilidades críticas (CVE-2026-48778 y CVE-2026-48800) en el popular editor Notepad++ que permiten la ejecución arbitraria de código (RCE). El fallo radica en la falta de validación de comandos dentro de los archivos de configuración (config.xml y shortcuts.xml). Los atacantes pueden explotar esto manipulando la sincronización en la nube, usando accesos directos maliciosos o mediante ingeniería social para ejecutar malware silenciosamente en el equipo de la víctima. Se recomienda actualizar urgentemente a la versión v8.9.6.1.
Post summary
The post announces critical RCE vulnerabilities in Notepad++ (CVE-2026-48778 & CVE-2026-48800) and recommends a patch to version 8.9.6.1, but does not provide PoCs, exploit code, or evidence of active exploitation.
#CVE-2026-48778 - Supply chain attack in Notepad++ pre-8.9.6.1. Unsanitized config.xml input leads to arbitrary command execution via File > Open Containing Folder > cmd. #CVSS 7.8. No patch available. Disable feature or isolate. #CVEAlert #sysadmin #developers More: https://www.valtersit.com/cve/CVE-2026-48778
Post summary
The tweet issues a CVE alert for CVE-2026-48778, describing a Notepad++ vulnerability that enables arbitrary command execution via an unsanitized config.xml file, assigns a CVSS score of 7.8, notes no patch exists, and recommends disabling the feature or isolating the system.
🚨*CVE* CVE-2026-48778 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the
Post summary
The post simply names CVE-2026-48778 with no additional information.
CVE-2026-48778 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (… https://www.cve.org/CVERecord?id=CVE-2026-48778
Post summary
The text offers a brief technical description of CVE-2026‑48778, noting a specific config.xml tag read by NppXml::value() before version 8.9.6.1, without mentioning PoC, exploit, active use, patch, or false‑positive status.
Full Tweet Notepad++ has released a security advisory addressing multiple critical vulnerabilities, including two arbitrary code execution flaws. The most severe flaw, CVE-2026-48778, allows attackers to silently run malicious code on a victim's machine via unvalidated…
Post summary
The tweet announces Notepad++’s security advisory, revealing two critical arbitrary code execution flaws, including CVE‑2026‑48778, but does not mention PoCs, exploits, or active attacks.
CVE-2026-48778: Notepad++ has released a security advisory addressing multiple critical vulnerabilities, including two arbitrary code execution flaws. The most severe flaw, CVE-2026-48778, allows attackers to silently run malicious code on a victim's machine via…
Post summary
Notepad++ has issued a security advisory for CVE-2026-48778, describing an arbitrary code execution flaw with a silent execution vector and implying that a patch is available, but no PoC, exploit code, or active exploitation reports are included.
⚠️ Vulnerabilidades en productos Notepad++ ❗ CVE-2026-48800 ❗ CVE-2026-48778 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-notepad/ https://t.co/vGNRxPAhql
Post summary
The tweet announces the existence of two CVEs affecting Notepad++ but offers no technical details, exploitation evidence, or remediation guidance.
Attention, elevated activities detected targeting Notepad++ (CVE-2026-48778) https://vuldb.com/vuln/367178/cti
Post summary
An alert reports increased activity against Notepad++ through CVE-2026-48778, with no exploit code, patch, or technical details provided.
Notepad++ の深刻な脆弱性 CVE-2026-48778／48800 が FIX：任意のコード実行の可能性 https://iototsecnews.jp/2026/05/28/critical-notepad-vulnerabilities-allow-attackers-to-execute-arbitrary-code/ Notepad++ における一連の脆弱性は、設定ファイルを読み込む際における入力値の検証不足に起因します。 脆弱性 CVE-2026-48778 では、設定ファイル内の特定の項目から値を読み込むプログラムの処理において、デジタル署名やホワイトリストによる安全性のチェックを一切行わずに保存してしまう不備がありました。同様の弱点は shortcuts.xml を対象とする CVE-2026-48800 にも存在し、改竄された設定ファイルを経由して、外部から指定された任意のプログラムが実行されてしまう状態を招いています。ご利用のチームは、ご注意ください。 #CVE202648770 #CVE202648778 #CVE202648800 #Notepad #Vulnerability
Post summary
The article announces and describes Notepad++ vulnerabilities CVE‑2026‑48778 and CVE‑2026‑48800 that enable arbitrary code execution through insecure settings file parsing, notes that patches are available, but provides no PoC, exploit code, or evidence of active exploitation.
Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems (CVE-2026-48778 and CVE-2026-48800) http://dlvr.it/TSnfqg #patchmanagement
Post summary
The tweet discloses that Notepad++ vulnerabilities (CVE-2026-48778 and CVE-2026-48800) could allow arbitrary code execution on Windows systems, underscoring the need for timely patching even though specific patches are not mentioned.
csirt_it: ‼️ #Notepad++: disponibili #PoC per le CVE-2026-48800, CVE-2026-48778 e CVE-2026-48770 che interessano il noto editor di testo Rischio: 🔴 Tipologia: 🔸 Arbitrary Code Execution 🔸 Denial of Service 🔗 https://www.acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 🔄 Aggiorname… https://t.co/siCgHZVjb5
Post summary
The post announces publicly available Proof‑of‑Concept code for three Notepad++ CVEs, providing a link to the PoC and noting the severity type, but it does not discuss active exploitation or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | notepad-plus-plus | notepad\+\+ | - | - | - |